fix(webui): version display, CSP guards, config traps, bucket-aligned stacking

Review fix round (4 Important + 2 folded):

1. Version display: OverviewView.vue was missing the muted version line
   the old vanilla-JS page rendered (types/api.ts already declared
   overview.version) - added.

2. CSP invariant now guarded twice: webui/generate.mjs's new
   assertNoInlineAssets fails the build if dist/index.html contains an
   inline <script> (no src= attribute) or any <style> tag - the exact
   condition the tightened admin CSP (script-src/style-src 'self', no
   'unsafe-inline') depends on. admin_test.go's new
   TestAdminIndexHTML_NoInlineAssets re-asserts the identical invariant
   server-side, against the decoded adminIndexHTML admin.go actually
   serves, so a regression is caught even if admin_assets_gen.go were
   regenerated with a modified copy of generate.mjs.

3. webui/components.json's iconLibrary:"lucide"/font:"inter" fields
   cannot be fixed in place - checked shadcn-vue's own schema
   (PRESET_ICON_LIBRARIES/PRESET_FONTS in the installed package): no
   "none"/fontawesome/system choice exists for either, and JSON (unlike
   the tsconfig.*.json files touched in the previous commit) has no
   comment syntax to warn inline. Documented instead: webui/README.md
   gained a loud warning section naming the exact regression (already
   hit twice this branch - a re-added Google Fonts import, a re-added
   lucide icon import) and the two-step fix to apply after any future
   shadcn-vue add/init call.

4. Real-CSP verification: the browser pass earlier in this branch ran
   under vite preview, which sends no CSP header at all. New
   integration/integration_test.go: TestAdminAssetCSP fetches GET
   /admin against the real Traefik+Yaegi pipeline, extracts the asset
   URL from its <script src="..."> tag, fetches that asset, and asserts
   both responses carry the exact adminCSP string byte-for-byte.
   admin.go's serveAdminAsset now also sets Content-Security-Policy
   (previously JSON/page routes only) so this holds for a direct
   navigation to an asset URL, not just as a same-origin sub-resource of
   GET /admin; admin_test.go's TestAdminAsset_Serving updated to match.

5. (folded) UsageChart.vue stacked the "tokens" tab's two series
   (tokin/tokout - two separate HTTP requests, not one atomic call) by
   positional index. A window rollover landing between the two requests
   could leave one series one bucket ahead, mis-stacking that refresh.
   Now aligns both series by their bucket key (a sorted union of every
   active series' buckets - the fixed-width, zero-padded bucket strings
   sort chronologically by construction), with a missing bucket in one
   series reading as 0 rather than shifting the whole series.

6. (folded) AuthGate.vue now triggers an immediate dashboard.refresh()
   on successful key submit, instead of waiting up to 5s for the next
   poll tick - the dashboard no longer sits blank right after auth.

Rebuilt via make admin-ui; admin_assets_gen.go regenerated.

webui/generate.mjs

@@ -61,6 +61,43 @@ function walk(dir, base = dir) {
   return out
 }
 
+/**
+ * assertNoInlineAssets fails the build if html contains an inline
+ * `<script>` (any `<script>` tag with no `src=` attribute) or any
+ * `<style>` tag. The admin CSP (admin.go's adminCSP) ships `script-src
+ * 'self'` and `style-src 'self'` with no `'unsafe-inline'` — that is only
+ * safe because `vite build`'s own output never needs it (an external
+ * `<script type="module" src="...">` plus an external `<link
+ * rel="stylesheet">`, nothing inline). This check is generate.mjs's own
+ * guard against that invariant silently breaking under a future Vite/
+ * plugin config change; admin_test.go's TestAdminIndexHTML_NoInlineAssets
+ * re-asserts the identical invariant server-side, against the DECODED
+ * adminIndexHTML admin.go actually serves — so a corrupted or
+ * hand-patched admin_assets_gen.go is still caught even if someone
+ * regenerates with a modified copy of this script.
+ */
+function assertNoInlineAssets(html, sourceLabel) {
+  const scriptTagRe = /<script\b([^>]*)>/gi
+  let match
+  while ((match = scriptTagRe.exec(html)) !== null) {
+    if (!/\bsrc\s*=/i.test(match[1])) {
+      console.error(
+        `generate.mjs: ${sourceLabel} contains an inline <script> (no src= attribute): ${match[0]}\n` +
+          `The admin CSP ships script-src 'self' with no 'unsafe-inline' — every script must be external.`,
+      )
+      return false
+    }
+  }
+  if (/<style\b/i.test(html)) {
+    console.error(
+      `generate.mjs: ${sourceLabel} contains a <style> tag.\n` +
+        `The admin CSP ships style-src 'self' with no 'unsafe-inline' — every style must be an external <link rel="stylesheet">.`,
+    )
+    return false
+  }
+  return true
+}
+
 /** goStringLiteral renders a Go double-quoted string literal for s, escaping the handful of characters that require it. base64 output never needs this (its alphabet is a strict subset of what a Go string literal permits unescaped), but this stays generic rather than assuming that forever. */
 function goStringLiteral(s) {
   return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
@@ -123,6 +160,10 @@ function main() {
   assetEntries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
 
   const indexBody = readFileSync(join(DIST_DIR, indexRel))
+  if (!assertNoInlineAssets(indexBody.toString('utf-8'), `${DIST_DIR}/${indexRel}`)) {
+    process.exitCode = 1
+    return
+  }
   const indexBase64 = indexBody.toString('base64')
 
   const sourceDigest = createHash('sha256')